Ideally post both logs, the full suricata log but also the one from zeek. Hard to compare/debug without more details.